Export limit exceeded: 425897 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

You must be logged in to use the 'userTag' filter.
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,897

Export CSV
CVE-2026-76859

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can exploit this flaw via ui_config_2.xml and misc.js to disclose router credentials.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Netcore
Products
Nr255-v
CVE-2026-76854

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network access.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Netcore
Products
Nr255-v
CVE-2026-66575

WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-58384

Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-91924

pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Sosedoff
Products
Pgweb
CVE-2026-91925

Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencies fields to execute operating system commands in the scheduler process context, exposing database credentials and service tokens.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Polyaxon
Products
Polyaxon
CVE-2026-91997

evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cs-technologies Evolution-foundation
Products
Evolution Evolution-api
CVE-2026-66608

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Unlimited-elements Wordpress
Products
Unlimited Elements For Elementor (free Widgets, Addons, Templates) Wordpress
CVE-2026-73009

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more
CVE-2026-53752

docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Plutext
Products
Docx4j
CVE-2026-57581

DotVVM: Unrestricted file upload

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Riganti
Products
Dotvvm
CVE-2026-57577

DotVVM: ReDOS in routing

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Riganti
Products
Dotvvm
CVE-2026-57578

DotVVM: Missing authorization in AuthorizeActionFilter

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Riganti
Products
Dotvvm